[m712]

Heck, companies are already starting to use CNAME records to fool ad/content blockers. I don't think what you're describing is far from becoming reality.

[chopin]

This is extremely dangerous if you have session cookies and don't configure them carefully.

For now, I commonly allow javascript/cookies on the top-level domain (I am a lazy uMatrix user). This will presumably change in future...